PatchTheCVECVE-2026-91950: FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32
CVE-2026-91950 is a medium-severity flaw (CVSS 6.5) affecting freerdp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.4% (top 66%) |
| CISA exploited list | No |
| Weakness | CWE-125 |
| Published | 2026-09-15 |
| Last modified | 2026-09-24 |
Last updated 2026-09-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-91950?
freerdp: upgrade to 3.31.0. Exact commands for each OS are on this page.
Is CVE-2026-91950 being exploited?
CVE-2026-91950 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-91950 affect?
CVE-2026-91950 affects freerdp. Severity is medium (CVSS 6.5). FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computer
How urgent is CVE-2026-91950?
Priority 36/100. Public exploit reference
Software pages
Related CVEs
- CVE-2026-109940 MEDIUM 4.3 UPGRADE FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wpr
- CVE-2026-109939 MEDIUM 6.5 UPGRADE FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in lib
- CVE-2026-109938 MEDIUM 6.5 UPGRADE Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can
- CVE-2026-109941 MEDIUM 6.5 UPGRADE FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows mal
- CVE-2026-109942 MEDIUM 6.5 UPGRADE FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/